High severity · published Feb 5, 2018
CVE-2017-15536
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain access to the CDSW database which includes Kerberos keytabs of CDSW users and bcrypt hashed passwords, and gain access to other privileged information such as session tokens, invitation tokens, and environment variables.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Data Science Workbench · Cloudera
1.0.0 before 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15536
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15536
Vendor Advisory
https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#tsb_248
More from Data Science Workbench
9.9
CVE-2018-20091
An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2
9.8
CVE-2018-11215
Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors
8.3
CVE-2018-20090
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2
5.3
CVE-2018-15665
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0